ESET Threat Blog

February 8th, 2010

Apple recently released a patch for the iPhone operating system. The fixes some pretty serious vulnerabilities, but… you must connect your iPhone to a computer and run iTunes to update the iPhone. This led me to start wondering how many iPhone users rarely connect their iPhones to a computer? I suspect there are quite a few people who rarely connect their iPhone to a computer and that could be a serious problem in the future. Because some of these vulnerabilities can lead to arbitrary code execution, it would be difficult to rule out an iPhone worm.

Ironically, the easy way to prevent a problem with the iPhone is the same way to prevent many problems on PCs, but we have a really hard time getting people to patch their operating system and applications. For current versions of Windows and Snow Leopard it is quite easy to patch if you just let the OS do its work. Some people turn of the automatic updates and often become victims. For third party applications the landscape is a bit more rugged. Some applications have automatic updates or automatic reminders to check for updates, but not all do.

I’m guessing that most of you who read the blog and have an iPhone probably connect your iPhone to your computer fairly often, but it is only a guess so, I have created a survey and if you own an iPhone I would be interested in your answers. This is a really short survey and I will stop collecting answers at the end of the week. Please feel free to refer friends who may not read the blog to the survey as well.

The survey is here

I’ll share the results when they have been collected.

Randy Abrams
Director of Technical Education
 

February 8th, 2010

For many years I have taught people that they really need to back up their data. Sometimes malicious software destroys data and a good back up is one defense against that type of attack, but more often data is lost due to many other reasons. In addition to backing up your data you need to verify the backup worked. That’s where I just got bit.

I got a MacBook Pro and I backed up my old hard drive… or so I thought. I didn’t validate the backup and a few files evidently didn’t get backed up.  The old hard drive had 3 partitions and over 150 gigabytes of data. I unpartitioned the hard drive and then created a single partition and formatted the drive.

I wasn’t really concerned with wiping the drive because I know where it will get used and with enough use my old data won’t be recoverable. Before I was about to turn in the old hard drive I decided to see what all cold be recovered, so I enlisted the assistance of our own Distinguished Researcher, Aryeh Goretsky. Aryeh has commercial recovery software.

Most of the former C drive was recoverable, however, the folders that contained the files I wanted were not recoverable. I’m trying a couple of other utilities to see if I can find the files, but life will go on splendidly without them anyway.

There are two morals to the story are:

1) Test your back ups. It can be quite useful to make sure you have the right number of files.
2) Much of your data is still quite easy to recover even after repartitioning your hard drive, so before you let an old hard drive get into an unknown person’s hands, make sure you use a file wiping utility.

Incidentally, for some things I make multiple backups just in case I lose one or the media fails.

Randy Abrams
Director of Technical Education

February 8th, 2010

As we've seen so many times before, cybercriminals are not ashamed to exploit horrors like the Haiti earthquake or 9/11, so it would be naive to expect them not to make use of our warmer sentiments, too. My colleague Urban Schrott at ESET Ireland has just blogged a cautionary note on that very topic. 

I recently blogged at Mac Virus about an excellent blog by Dancho Danchev on “How the Koobface gang monetarizes Mac OS X” by compromising legitimate sites with a PHP backdoor shell in an attempt to direct OS X traffic to affiliate dating programmes.  

As I mentioned at the time, Dancho included a lot of detail on a range of scam dating sites that are currently active. Not surprisingly, we’re seeing somewhat related material (Russian bride scams, malware populated domains with Valentine’s Day themes)  at ESET.

Here are some domains Pierre-Marc has flagged that include malware-populated pages that seem to have Valentine's Day themes. (For obvious reasons, I haven't included the full pages.)

  • hxxp://holidays.prosperity66.com/ 
  • hxxp://obscurepop.com/ 
  • hxxp://www.webfetti.com/ 
  • hxxp://www.3wishes.com
  • hxxp://www.whatstruehealth.com/ 
  • hxxp://my-vogue.com/2009/01/st-valentine-sexy-and-trendy-apparel/

I'm also hearing about large quantities of Russian Bride spam: my colleague Urban Schrott in Ireland has mentioned sites like datemeet.ru and girlandboysex.ru. Journalist Larry Seltzer has also mentioned receiving lots of this stuff.

Checking my own spam traps, I found some of those fake eCards that Randy loves so much, a sprinkling of  East European ladies wanting to get to know me, and an avalanche of Viagra spam. I wish I could tell you what my wife said about that, but this is a family blog.

By the way, quite a few of those fake eCards include bit.ly compressed URLs. You might want to watch out for those.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch (or http://twitter.com/ESETblog)
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

Also blogging at:
http://smallbluegreenblog.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macvirus.com/

February 7th, 2010

News has just been released about the shutting down of what is believed to be the “biggest hacker training site” in China. This is good news.

Three people from the Hubei province were arrested and the website was closed down. The site was known as the “Black Hawk Safety Net”. It is reported that, since it was established in 2005, the site had recruited more than 12,000 VIP members and collected more than 7,000,000 yuan in membership fees. More than 170,000 people had registered for free membership to the site.

According to the reports, more than 50 police officers were involved in the investigation of the case. They seized nine web servers, five computers and one car. They also shut down all the web sites involved with the case.

Now, the size and scale of such a hacker based organization may be considered alarming, but to some of us not exactly surprising.

But what I find really interesting here is the timing of the announcement regarding these arrests and the subsequent shutting down of the website.

This is old news. Apparently, this all occurred in November, 2009. So why wasn’t it announced then? Why now…? Call me cynical if you like, but I can’t help but suspect that this news has been released now in an effort by Chinese authorities to try and bolster their claims that they do not condone hacking, following claims that the recent attacks on Google and many other foreign companies in China had been backed by the Chinese government.

What better way to prove your commitment to stamping out hacking activities than to come up with a news report to show what you are doing about the problem. The fact that this actually happened (assuming it did happen…) about three months ago seems to have been largely glossed over in many of the news items I have seen about this event.

You make up your own mind. But I tend to think this is a news story that has been announced for its convenient timing, more than anything else….

Craig Johnston
Senior Cybercrime Research Analyst

February 7th, 2010

These are a few questions relating to ESET's antivirus scanner for OS X, which is currently in beta, that I was asked in response to a post at Mac Virus. (If you want to take the beta out for a spin, you can still download it at http://beta.eset.com/macosx.)

As these questions are very ESET-specific, I thought it was more appropriate to answer them here rather than at Mac Virus.

1. You mentioned at the Eset blog in response to one of my comments that you where running EAV for Mac, on your Mac. So I am just wondering what the average Memory and CPU usage is for EAV on a Mac?

Yes, I'm running ESET's beta scanner on one of my Macs. I haven't looked at performance metrics, and I probably won't even if it starts to look anomalous. I don't have the time and resources to do accurate performance testing here at the moment, and I don't know that it would be useful anyway. The product is still liable to drastic change, as pre-release products tend to be.

2. Also wondering why Eset don’t show how many malware’s records that’s in your database? Not that it is very important that I know how many, but why not?

 Do you mean how many "signatures" do we have, or how many individual items of malware we detect? The two figures don't actually correlate in a way that would be useful: I don't know how many individual detections we have, but to give that number  would be misleading, since there isn't a single detection to every malicious binary.

Note that this is true of all mainstream AV vendors: because virus labs receive tens of thousands of unique binaries to analyse every day, the emphasis has to be on the most effective way of detecting as many of them as possible, not on precise classification, which is why malware information databases tend to be fairly generic nowadays.

ESET's detections are highly generic (meaning that a whole family or families, variants and subvariants might be picked up by a single detection) and/or heuristic (malware is detected by its characteristics or behaviour rather than by exact or near-exact identification): INF/Autorun, for instance, detects an enormous range (and volume) of malicious programs with two characteristics in common: (a) they try to exploit AutoRun (b) they're malicious! .

3. I know that the Mac version of NOD32 is crossplatform and detects Mac,Linux,and Windows malware. But does the Windows version detect Windows, Mac, And Linux malware as well?

Yes, ESET scanners for Windows detect malware OS X and Linux malware.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch (or http://twitter.com/ESETblog)
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

Also blogging at:
http://smallbluegreenblog.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macvirus.com/
 

February 7th, 2010

[Part 7 of an occasional series, updating a blog series I ran in early 2009 to reflect changes in the threat landscape. This series will also be available shortly as a white paper.]

Call For Backup

If sensitive information is stored on your hard drive (and if you don’t have something worth protecting on your system, you’re probably not reading this blog), protect it with encryption.

Furthermore, when you copy or move data elsewhere, it’s usually at least as important to protect/encrypt it when it’s on removable media, or transferred electronically. Even if the target storage device is secure from malware or hacking, you also need to be aware of other dangers such as physical risks, transit risks, business-related risks such as an escrow site going out of business and so on.

Consider (seriously!) regularly backing up your data to a separate disk (as a bare minimum) and, where possible, a remote site or facility. Sounds extreme? Think about it.

  • You can’t rely on backing up to another partition on the same disk as the original: if the disk dies, the chances are that all partitions will be lost.
  • You can’t rely on backing up to another disk on the same system. If the system is stolen, or there’s a fire, for instance, then in the immortal words of Tom Lehrer they’ll "all go together". In the latter instance, the chances are that you’ll lose your thumb drives, CD-RWs and so on as well.
  • And if you’re working in a corporate environment, you might want to avoid doing what one site I know of did, and back up data to a server, but forget to back up the server itself.

I’m sure I don’t need to remind you to take care of your passwords as well, do I?

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch (or @ESETblog)
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

Also blogging at:
http://smallbluegreenblog.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macviruscom.wordpress.com/

February 5th, 2010

Perhaps you read the Mozilla blog at http://blog.mozilla.com/addons/2010/02/04/please-read-security-issue-on-amo/ where it was revealed that two add-ons for Firefox were infected with Trojans. In this case the distribution was very small, so not many users were infected, but this type of attack is likely to grow.

A large part of the time I worked at Microsoft I was responsible for ensuring that Microsoft did not release infected software. To some extent my job was made easier by the fact that most of the software was developed at Microsoft and the rest of was from 3rd parties who had a financial interest in maintaining business ties with Microsoft. For companies like Mozilla, Apple, And Google the job is far more difficult.

The add-ons are not “Firefox” or Mozilla code. Anyone is welcome to write an add-on and submit it for distribution. Apple’s iPhone App Store let’s anyone write and distribute applications for the iPhone. Just as Mozilla experienced a malicious contributor, Apple has had to pull spyware applications off of the iPhone App Store according to an article at http://news.cnet.com/8301-27080_3-10446402-245.html.

Google will allow developers to write applications for the Android phones and you better bet there will be some malicious ones. Facebook, MySpace, Orkut, and other popular social networking sites allow people to write and distribute applications.

The common thread is that you, the consumer, do not know who wrote these applications, what their intent is, or what their knowledge of security is. In the case of Rockyou.com, miserable security malpractice resulted in over 32 million user email addresses and passwords being compromised.

No matter whether you use a Mac or a PC, an iPhone, an Android, a Blackberry, or some other device, be careful when choosing to install an application or add-on. Find out who it is from and that there is a reason to trust them or you may find your free program is very expensive.

It is good that Mozilla had added a couple more virus scanners to their arsenal, but they probably should be using a whole lot more than three and I would question if they have the process for publishing add-ons tuned to where it should be. They are doing a good job, but there is often room for improvement.

If they would like me to assist with their process, I think they know where to find me. I’d be happy to provide insight, experience, and recommendations at no cost should they choose to pursue it.

Randy Abrams
Director of Technical Education

 

February 5th, 2010

No, I'm not talking about a newly-discovered and virulent OS X upconversion of SevenDust or AutoStart 9805.

Mac Virus is a site founded by Susan Lesch in the 1990s, when pre-OS X Mac-specific malware was still a serious issue - AutoStart in particular caused significant damage back then – and cross-platform macro viruses were also a major problem. I co-maintained it for a while, then took it over when Susan couldn't spare the time, but it became relegated to the backburner as I got tied up with a whole lot of other things.

However, I've had occasion to do a load of research recently into the Mac malware scene, both at ESET and with outside organizations, so I've taken to blogging there on a regular basis, as there isn't much in the way of independent Apple-related security sites at the moment, considering how that scene is hotting up.

I suppose I ought to call it Mac Malware or even Mac Threats (or something) rather than Mac Virus – viruses are clearly much less dominant nowadays – but the domain name is http://www.macvirus.com so I guess I'll stay with the old "brand" for now. (No, I'm not making any money out of it!) You can get straight to the blog page, which is its primary purpose right now, here.

That doesn't mean I won't be blogging on Mac issues here, of course. In fact, I envisage a lot of cross references between that blog and this one, as ESET becomes more engaged with the Mac community.  In general, whether the primary home for a specific item is here or there will depend on whether I write it on ESET's time or my own, though Mac Virus posts will remain vendor-neutral.

Just to give you a flavour of what's being posted there at the moment, here are the last few blogs:

ESET is exhibiting at MacWorld 2010 in San Francisco, by the way: that's February 9th-13th: see http://www.macworldexpo.com/. I won't be there, but I'm sure the guys who are will be pleased to talk about the Mac beta program (or pretty much anything else).

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch (or http://twitter.com/ESETblog)
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

Also blogging at:
http://smallbluegreenblog.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macvirus.com/

February 3rd, 2010

Every now and then, when I get a new batch of spam emails (which happens with monotonous regularity), I wonder who is clicking on those links to purchase products when they get spam emails offering great deals.

Are there actually that many guys out there with erectile problems? Are there really that many people out there who would buy medications sight unseen over the Internet? Do people really think that super cheap perfume and watches are actually going to be quality products worth buying? Are they really confident that they are even going to get anything delivered to them for their money? Or that the amazing health insurance deal they just signed up for (and paid a few months in advance for) will actually offer them any cover at all?

And then there’s the lottery wins. How many people believe that they, out of the blue, have actually won millions of dollars in a lottery they never entered in the first place? And amazingly, it seems, can win two or three lotteries per week! Who is THAT naive? Or maybe believe that the tax department have made a mistake and want to give them a refund via email.

Let’s not forget the emails announcing the unexpected windfalls from deceased people they never knew. Supposed solicitors send them emails informing them that some person, somewhere in the world is supposed to have bequeathed a huge sum of money to them, for no apparent reason.

Who believes stories like these?

And do people who buy products from spammers really believe that the spammers are actually going to use their credit card details responsibly and not use those details for other purposes?

Hmmm, maybe I’ve been in this business for too long. But to me they all seem obviously fake and certainly a dodgy way to do any sort of
business. I steer well & truly clear of them. Especially when it comes to medications. If I bought some pills over the Internet, from some
place that sent me an email that I didn’t ask for, how could I be sure I’m getting what I paid for? If I swallowed that little blue pill that
arrived in the post after I bought it online, how could I be sure that it would only make a certain part of my body stiff, and not my whole
body stiff because it actually contains cyanide and killed me? Its one thing to buy a watch that turns out not to be what I expected, but
medicines are a completely different matter!

I can’t help but think if people didn’t fall for these tricks, weren’t so greedy, and therefore didn’t click on the link or open the attachment that came with the email, we would see the volume of spam decrease dramatically. There must be lots of money to be made in this business, otherwise the bad guys would give it up and move on to something more lucrative. But somebody somewhere must be clicking on those links, opening those attachments, and responding to big windfall notices. In fact a lot of people must be doing it!

So if you’re buying goods & services from unsolicited emails, please stop doing it. If you believe emails telling you you’ve won a stack of
money out of the blue, please don’t be so naive. Ignore and delete them.

Ah, if only we could get that message out to everybody on the Internet, and have them take heed. It shouldn’t be too hard. But I guess human nature being what it is, people will continue to be sucked into scams & dodgy deals.

It just frustrates me sometimes. Spam emails should not be anywhere near as successful as they are.

Craig Johnston
Senior Cybercrime Research Analyst

February 3rd, 2010

There's an interesting post by Lee Graves about fake Firefox updates that actually push adware.

It's pretty comprehensive, and lots of other blogs have picked up on it, so I won't rehash the issue here. However, I notice that The Register have credited us with the story (though they may have changed it by the time you read this). :)

Just to clear up any confusion, that "threatcenter" blog at blogspot is nothing to do with us, despite the similarity in the names. Ironically, it's sponsored by eSoft, whose name is also not that different to ours.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch (or http://twitter.com/ESETblog)
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

Also blogging at:
http://smallbluegreenblog.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macviruscom.wordpress.com/